Description of setuid, setgid, and sticky Permissions

Article Title: Description of setuid, setgid, and sticky permissions. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

Each file has an owner, indicating who created the file. At the same time, the file also has a group number, indicating the group to which the file belongs, generally the group to which the file owner belongs.

If it is an executable file, the file generally only has the permission of the user who calls the file, while setuid and setgid can change this setting.

Setuid: set to grant the file owner permissions during execution. the typical file is/usr/bin/passwd. if a common user executes the file, the file can obtain the root permission during execution, so that the user's password can be changed.

Setgid: this permission is only valid for the directory. After the directory is set to this bit, any files created in this directory have the same group as the directory.

Sticky bit: This bit can be understood as a non-delete bit. whether a file can be deleted by a user depends on whether the file group has the write permission on the user. if you do not have the write permission, all files in this directory cannot be deleted or new files cannot be added. if you want to add a file but cannot delete the file at the same time, you can use the sticky bit for the file. after this bit is set, the file cannot be deleted even if the user has the write permission on the directory.

The following describes how to operate these labels:

The operation marks are the same as the operation File Permission command, and are all chmod. There are two methods to operate,

1) chmod u + s temp -- add the setuid flag to the temp file. (setuid is only valid for the file)

Chmod g + s tempdir -- add the setgid flag to the tempdir directory (setgid is only valid for the Directory)

Chmod o + t temp -- add the sticky flag to the temp file (sticky is only valid for the file)

2) Adopt the octal mode. for general files, use three Octal numbers to set the flag, such as 666,777,644. if these special characters are set, a group of Octal numbers is added to this group of numbers. such as 4666,277 7. the meanings of the three octal digits in this group are as follows,

Abc

A-setuid bit. If this bit is 1, setuid is set.

B-setgid bit. If this bit is 1, setgid is set.

C-sticky bit. If this bit is 1, sticky is set.

After these flags are set, you can use ls-l to view them. If these flags exist, they will be displayed in the original execution flags. For example:

Rwsrw-r -- indicates that the setuid flag exists.

Rwxrwsrw-indicates that the setgid flag exists.

Rwxrw-rwt indicates sticky flag

So where did the original execution mark x go? The system stipulates that, if there is x in this bit, these special signs will be displayed as lowercase letters (s, s, t ). otherwise, uppercase letters (S, S, T) are displayed)